What is the CVSS score of CVE-2026-28868?

CVE-2026-28868 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of macOS are affected by CVE-2026-28868?

Organizations using A logging should be aware of moderate risk from CVE-2026-28868, a log file exposure vulnerability rated CVSS 5.5. This could allow unauthorized file access.. A patch is available.

How to fix or mitigate CVE-2026-28868?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

macOS CVE-2026-28868

EUVD-2026-15147 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-03-25 apple

GHSA-mpf9-68p5-x53h

Apple Information Disclosure macOS iOS

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

15.7.5,26.4,18.7.7

EUVD ID Assigned

Mar 25, 2026 - 01:00 euvd

EUVD-2026-15147

Analysis Generated

Mar 25, 2026 - 01:00 vuln.today

CVE Published

Mar 25, 2026 - 00:35 nvd

MEDIUM 5.5

DescriptionCVE.org

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4, watchOS 26.4. An app may be able to disclose kernel memory.

AnalysisAI

A logging issue in Apple's operating systems allows improper data redaction, potentially enabling applications to disclose kernel memory contents. This information disclosure vulnerability affects iOS and iPadOS (versions prior to 18.7.7 and 26.4), macOS (Sequoia 15.7.5, Sonoma 14.8.5, Tahoe 26.4), visionOS 26.4, and watchOS 26.4. An untrusted application with standard execution privileges could exploit this to read sensitive kernel memory that should have been redacted from logs, potentially exposing cryptographic material, memory addresses useful for ASLR bypass, or other privileged information. No CVSS score, EPSS data, or public proof-of-concept has been disclosed at this time, and this does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog.

Technical ContextAI

The vulnerability resides in Apple's logging subsystem across multiple platforms (iOS/iPadOS, macOS, visionOS, watchOS as identified via CPE strings cpe:2.3:a:apple:ios_and_ipados, cpe:2.3:a:apple:macos, cpe:2.3:a:apple:visionos, cpe:2.3:a:apple:watchos). The root cause is insufficient data redaction in logging mechanisms, allowing kernel memory disclosure—a classic information disclosure flaw (analogous to CWE-200: Exposure of Sensitive Information). When applications or system services generate log entries containing sensitive kernel data, the logging framework fails to properly sanitize or mask this information before it becomes accessible to applications. This could stem from inadequate filtering rules, incomplete redaction patterns, or race conditions between memory access and log sanitization routines.

RemediationAI

Update affected devices to the patched versions immediately: iOS and iPadOS to version 18.7.7 or 26.4 or later; macOS to Sequoia 15.7.5, Sonoma 14.8.5, or Tahoe 26.4 or later; visionOS to 26.4 or later; and watchOS to 26.4 or later. Users should enable automatic security updates in Settings (iOS/iPadOS/watchOS) or System Settings (macOS/visionOS) to prevent future exposure. For organizations managing large device fleets, use Mobile Device Management (MDM) or enterprise management tools to enforce patch deployment. Until patching is complete, monitor application behavior and restrict third-party app installation to trusted sources only. No workarounds exist for the underlying logging redaction issue; patching is the only remediation.